fix(subagent)!: reject unknown keys in nested tools/permissions frontmatter

[bug-ops]

Summary

• RawToolPolicy and RawPermissions (the tools:/permissions: nested sections of sub-agent frontmatter) did not propagate RawSubAgentDef's #[serde(deny_unknown_fields)] into their own structs, so a typo inside either section (e.g. pemission_mode:, alow:) was silently ignored and fell back to the section's fail-safe default instead of failing to load. Both structs now carry deny_unknown_fields directly.
• Adds a regression test that drives the real handle_scheduler_spawn_action/intersect_task_tool_allowlist wiring end-to-end through run_scheduler_loop, asserting the tool definitions delivered to a spawned sub-agent's LLM are the true intersection of the parent-permission floor and the per-task planner-emitted allowlist. The existing composition test only exercised the decomposed zeph_subagent::intersect_allowlists/task_tool_allowlist_for_task helpers in isolation, never the actual call site.

Breaking change

A sub-agent frontmatter file with a misspelled key inside its tools: or permissions: section now fails to load instead of silently falling back to defaults for that section. Not an exploitable privilege escalation (every existing default is already conservative/restrictive) — this closes a silent-misconfiguration trap where an operator's intended tool/permission restriction never took effect.

Closes #6583
Closes #6539

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins (2736/2736 in touched crates, full workspace clean)
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler"
• gitleaks protect --staged --no-banner --redact
• 2 new #6583 tests independently verified as genuine regression guards (temporarily removed deny_unknown_fields, confirmed both new tests fail, restored)
• New #6539 test independently verified as a genuine regression guard (temporarily reverted intersect_allowlists to a naive overwrite, confirmed the test fails with the expected leaked-tool mismatch, restored)
• CHANGELOG.md updated under [Unreleased]/Fixed with breaking-change note